Slashdot Mirror
McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000
Kohenkatz writes "A McAfee Update today (DAT 5958) incorrectly identifies svchost.exe, a critical Windows executable, as a virus and tries to remove it, causing endless reboot loops."
Reader jswackh adds this terse description: "So far the fixes are sneakernet only. An IT person will have to touch all affected PCs. Reports say that it quarantines SVCHOST. [Affected computers] have no network access, and missing are taskbar/icons/etc. Basically non-functioning. Windows 7 seems to be unaffected."
Updated 20100421 20:08 GMT by timothy: An anonymous reader points out this easy-to-follow fix for the McAfee flub.
at a command prompt when the "windows will shut down in XX seconds" popup us on screen saved me. I'm still waiting for a mcafee update file to fix it properly.
Nullius in verba
Seriously. They consume CPU. They stay resident and consume usable memory. They occasionally crash and/or cause other applications not to work. And, in this situation, they break Windows. I don't use AV and have had pretty much zero issues over the last 6 years of using Windows XP. All you need to do is:
* Configure Windows update to run daily.
* Don't use IE or Outlook.
* Keep Windows Firewall active.
* Don't connect directly to the internet- sit behind a router that's configured to be (mostly) invisible.
* Don't run random things you get sent in email, on facebook, or that pop up unexpectedly while you're at a questionable website.
* If you think something's amiss, boot into safe mode and use a non-resident tool like MBAM.
Basically it looks like command line
shutdown -a (to stop the autorestart)
Put SVChost.exe back in place (out of the quarantine )
and disable McAfee...
DJMD - The fourth man - Planetary
I work at a major chip manufacturing plant. At 4.10 I was conferencing with another fab when all our PCs shutdown. 10 minutes later the place was in chaos. Now don't get me wrong the fab keeps going but my god the cost to the company of this. Say 10 sites world wide with 2-5k employees each the majority of which can't do any meaningful work. McAfee have a lot to answer for.
Every system that we had that was XP SP3 that got updated to the 5958 DAT file became useless. We are now forced to visit each machine and manually fix it. Rubbish.
"I'm just here to regulate funkiness."
True, but business needs dictate software requirements. So that decision is out of my hands (but believe me, I'd LOVE to run an office full of Linux computers)...
Interesting.
We're forced to use Windows on Dell laptops, though I can see no business needs for it, nor any technical requirements (SaaS suites are used, and our various applications are almost all running on some Unix derivative). Our Exec team are all using OSX, showing that non-techies are quite able to do their business without Windows. Even then, there is no way in hell we'll get away from Windows, and almost as little chance we'd get away from Dell even if everyone in Internal IT hates Dell.
There is no such thing as a reputable site on the internet.
Some sites use ad networks, which have happily served malware.
Other sites are run by clueless admins and left vulnerable to commodity exploits.
Drive by Downloads exist, and a risk everywhere.
I agree that it raises question as to why one should use them, but "down time" is not the biggest threat out there, if you wanna talk loss/cost. While one's time is valuable, I'm thinking that their bank account information, passwords, etc, might be slightly more valuable to them. Personally, I think good secure end-user practices is the best protection, I do think that a good A/V program is needed.
So, while there is malware out there that is less harmful, more of the malware out there is much MORE harmful... if you disagree, please provide your financial account information, or contact me to transfer all funds to a secured off-shore account... maybe buy me a new car too! ;-)
But seriously... this is really bad, and REALLY stupid. But having no protection for most users risks damaging them in ways worse than a few hours of time to manually fix their issue. And from a corporate perspective, loss of sensitive information is a BIG deal and can cost a LOT more. And that's just talking about data loss. Being part of a botnet to help facilitate financial fraud and other badness... that's also double plus ungood... and irresponsible to not take measures to help keep your computer from playing a part in those crimes.
Anyway... I agree it raises question... but there more downside to malware than just downtime.
Norton, McAfee and Trend Micro have very solid products that allow for remote management, deployment, updates, forced scans, etc.
Avast (which I use at home) does not have all of these features yet. I can tell you that when dealing with hundreds of machines, having that dashboard for antivirus saves many hours of time. You can run more frequent scans on problem machines, or allow more/less freedom with the click of a button. Many of the products also have URL blocking (by category), email attachment filtering through Exchange plugins, etc. One feature I like about Trend Micro is the "behaviour" plugin, which flags anything out of the ordinary - such as accessing files, programs, or drives that they haven't before.
Corporate networks also typically have edge firewalls that will catch many of the malware infested URLs, email attachments, etc that cause problems. For many businesses 200+ computers, the Windows-installed Anti-virus software is actually the last line of defense. Often times the loss of productivity of a couple viruses getting through isn't worth the extra $$ invested in more products or a "better" product with less management features.
Licencing is also a plus. While Norton, McAfeee and Trend Micro are expensive initially, additional licences for a large number of computers and renewal licences each year actually make it less expensive than others such as Avast and Panda.
We have hundreds of systems down. We were looking at Avira in any event as it was lighter, but now we are moving there at warp speed. Mcaffee's quality assurance really screwed up on this. Major problems worldwide.
Subject line says it all...
retrorocket.o not found, launch anyway?
Svchost has been around forever. It basically encapsulates other applications. Svchost handles many things from DCHP client to Windows Themes. The problem is that McAfee doesn't seem to discriminate between any of them in this case. Which would cripple any XP system today.
Well, there's spam egg sausage and spam, that's not got much spam in it.
The story just hit ABC News, via the Associated Press: "McAfee Antivirus Program Goes Berserk, Reboots PCs" There are stories on the Huffington Post and NextGov. The story just broke into mainstream news in the last hour. It just hit the New York Times.
There's nothing on McAfee's home page about this yet. No items in their "News" or "Threat Center" or "Breaking Advisory" sections. There's supposedly a McAfee Knowledge Base article, "False positive detection of w32/wecorl.a in 5958 DAT", but their knowledge base site is overloaded. When it eventually loads, there's a download link to a patch. But there's nothing like an apology. All they say is "Problem: Blue screen or DCOM error, followed by shutdown messages after updating to the 5958 DAT on April 21, 2010."
McAfee has botched their damage control. They should be out there apologizing. Meanwhile, you can watch McAfee stock drop.
Yup - My contacts at Intel say they are down accross the board - more accuartely across the world (thats over 110,000 workstations folks). Employees are being advised to use their laptops and to make sure that they are not plugged into the network.
Comcast decided to start providing Norton instead of Mcafee to its customers.
After years of not using a signature, I am going to make one to say the following: Fuck Beta
Our fix method is as follows:
Download the extra.dat file from http://download.nai.com/products/mcafee-avert/wecorl/extra.dat and put it on your favorite removable media.
Reboot into safe mode.
Control-Shift-Esc to access Task Manager.
File, Run, cmd to access Command Prompt.
Copy extra.dat to C:\Program Files\Common Files\McAfee\Engine
Copy C:\windows\system32\dllcache\svchost.exe C:\windows\system32 (and overwrite).
Reboot into regular mode.
I have to wonder what controls the various AV companies have to prevent a malicious signature be inserted - for example, someone deliberately doing something like this (but hitting all versions of Windows).
It's not just McAfee that's had this particular style of false-positive problem - Symantec also falsely identified a legitimate part of the Windows 2003 Server resource kit as malware. Fortunately in Symantec's case the damage was very limited.
Oolite: Elite-like game. For Mac, Linux and Windows
The first post was posted at 2:03pm (in my timezone) .. yours was posted at 2:07 so all things considering, a 4 minute fix isn't too bad...
There's a gorilla from Manilla whose a fella that stinks of vanilla and has salmonella.
ClamWin *itself* doesn't have an on-access scanner but...
On the other hand, there are numerous plugins to hook clamwin to, so you can check for virus at their point of arrival.
(On the client's side there are Firefox and Outlook plugins, on the server's side there are Samba plugins)
but personally I supplement always ClamWin with a 2nd antivirus featuring a on-demand scanner.
ClamWin&Plugins +Avira or +AVG.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Computerworld reports that McAfee has reacted to user complaints by shutting down their support forum. The forum seems to be back up now. That was an extremely dumb move to pull after the story was already in the New York Times, Business Week, and on TV.
Many frantic users in the forum. The big losers are the enterprise users who bought into McAfee's premium services, with automatic corporate-wide updating. There's no fully automatic, reliable fix yet for systems already damaged. In some cases, it's apparently necessary to bring in a new copy of "svchost.exe"; the one in quarantine is bad.
This points up a major risk to US computer infrastructure. Any program with remote update is potentially capable of taking down vast numbers of systems. Ones like McAfee or Windows Update, which deploy updates to all targets simultaneously, can cause widespread damage quickly. Remote updating by vendors may need to be regulated, as a public policy issue.